clean up POM transitive dependencies

* exclude commons-logging, since the SLF4J Commons Logging replacement
  is installed
* don't use the version of JUnit with embedded Hamcrest; instead pull
  Hamcrest in through transitive dependencies
* ensure that all modules of Hamcrest are the same version
* use individual Hamcrest libraries instead of bundle to leverage
  Maven's version conflict resolution